amlreport[.]guru

Analysis of amlreport.guru shows that the domain was registered on June 24 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com. The site is currently offline but historically resolved to the IP address 104.21.42.232, which belongs to AS13335 operated by Cloudflare, Inc. and is geolocated in the United States. No SSL certificate was observed for the host, indicating that HTTPS was not configured at the time of capture. The page title returned by the web server was “AMLBot - One‑stop compliance solution for crypto business”, which aligns with the listed scam type of a crypto scam and the declared impersonation of the Binance brand.

The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy feed. VirusTotal recorded a single positive detection out of ninety‑five submitted scanners, confirming that at least one security vendor identified malicious behavior. Gridinsoft assigned a trust score of 0 / 100, reinforcing the classification as highly untrusted. Nameserver information was not available in the intelligence set, and no additional HTTP headers or certificate details were captured.

The risk rating is elevated, reflecting the combination of brand impersonation, low trust score, and detection by multiple threat‑intelligence sources. Defenders should add 104.21.42.232 to network‑level deny lists, enforce block rules for the fully qualified domain name, and monitor for any future re‑hosting of the domain or similar look‑alike registrations. Continuous observation of Cloudflare‑hosted IP ranges for new Binance‑related phishing payloads is advised, as the infrastructure may be reused by the same threat actor. Because the site is offline, dynamic analysis is not possible, and further investigation should focus on historical HTTP traffic logs, DNS query patterns, and any residual artifacts that may have been delivered to victims.